Code vulnerability detection method and system based on code translation large model

Abstract

The invention belongs to the technical field of code vulnerability detection, and particularly relates to a code vulnerability detection method and system based on a code translation large model. According to the method, on the basis of an initial programming language type and a target programming language type, forward translation and reverse translation processing is carried out on a to-be-translated code through a plurality of translation large models; according to the method and the device, the target similarity between each code to be translated and the corresponding reverse output code is obtained, and the similarity vector sequence is constructed based on the target similarity between each code to be translated and the corresponding reverse output code, so that the vulnerability occurrence probability of the similarity vector sequence can be obtained through the code vulnerability detection model, and whether multiple types of codes to be translated have vulnerabilities or not can be accurately judged. The method has the advantages of multiple detectable programming language types, high detection efficiency and high detection accuracy.

Description

Technical Field

[0001] This application belongs to the field of code vulnerability detection technology, and more specifically, relates to a code vulnerability detection method and system based on a large code translation model. Background Technology

[0002] Code vulnerability detection is an important field of computer science, involving the static and dynamic analysis of software code to discover potential security vulnerabilities. Existing code vulnerability detection techniques mainly include static code analysis and dynamic code analysis. Static code analysis discovers vulnerabilities by analyzing the structure and syntax of the source code, while dynamic code analysis discovers potential errors by monitoring the execution process of the source code.

[0003] Static code analysis involves complex operations such as constructing abstract syntax trees, performing data flow analysis, and control flow graph analysis. It is only suitable for detecting vulnerabilities in a limited number of programming languages. Dynamic code analysis, on the other hand, can only detect vulnerabilities when significant errors occur during code execution. Therefore, both existing static and dynamic code analysis methods suffer from low detection efficiency and a high rate of false negatives and false negatives. Summary of the Invention

[0004] To address the aforementioned shortcomings of existing technologies, this application provides a code vulnerability detection method based on a large code translation model, aiming to achieve accurate detection of code vulnerabilities using a well-trained large translation model.

[0005] Firstly, this application provides a code vulnerability detection method based on a large-scale code translation model, including: S1. Obtain the code to be translated and the corresponding initial and target programming languages, and preprocess the code to be translated; S2. Transmit the preprocessed code to be translated to each target translation model, and perform code translation processing on the code to be translated based on the target translation model and the target programming language to obtain the positive output code. S3. Based on the target translation model and the initial programming language types, perform code translation processing on the forward output code to obtain the reverse output code; S4. Based on the preset similarity calculation function, obtain the target similarity between the code to be translated and the reverse output code. Based on the code vulnerability detection model, perform detection processing on the target similarity corresponding to each target translation big model to obtain the vulnerability detection result corresponding to the code to be translated.

[0006] Furthermore, the code to be translated is preprocessed, including: Based on the preset regular expressions corresponding to the target programming language, comments in the code to be translated are deleted, and variable names and function names in the code to be translated are standardized based on the keyword table corresponding to the target programming language.

[0007] In particular, removing comments from the code to be translated and standardizing variable and function names in the code to be translated can eliminate useless text in the code data, ensuring that the model focuses on the logical structure of the code itself. Standardizing variable and function names can effectively eliminate differences caused by developers' personal coding styles, ensuring that the content input into the model is a valid code snippet.

[0008] Furthermore, the preprocessed code to be translated is transmitted to each target translation model, including: Based on the official syntax data, third-party syntax data, and language framework data corresponding to the target programming language and the initial programming language in the database, a target programming language syntax library is constructed. The code to be translated is split into multiple retrieval units based on a preset parser, and features are extracted from each retrieval unit based on the target bidirectional encoder model to obtain multiple vectors to be translated. These vectors are then integrated into a vector library of code to be translated.

[0009] Furthermore, the preprocessed code to be translated is transmitted to each target translation model, including: Based on the target translation big model and each vector to be translated, the code to be translated is extended to obtain an extended code library including multiple extended codes. The code to be translated, the vector library of the code to be translated, the target programming language syntax library and the extended code library are then transmitted to each target translation big model.

[0010] Since the training process of the target translation large model requires a large dataset and consumes a lot of computing power, the method of this application assists the translation large model in translating the code to be translated by establishing a knowledge base such as a target programming language syntax library, a code vector library and an extended code library that are directly related to the code to be translated. This can improve the translation accuracy of the target translation large model without retraining it.

[0011] Based on the target translation model and the types of target programming languages, code translation processing is performed on the code to be translated, including: The translation process of the target translation model is assisted by a vector library of the code to be translated, a syntax library of the target programming language, and an extended code library. Based on the type of target programming language, the assisted target translation model is used to process the code to be translated.

[0012] Furthermore, based on a preset similarity calculation function, the target similarity between the code to be translated and the reverse-output code is obtained, including: Based on the target bidirectional encoder model, feature extraction is performed on the code to be translated and the reverse output code respectively to obtain the first feature vector sequence corresponding to the code to be translated and the second feature vector sequence corresponding to the reverse output code. Then, the similarity between the first feature vector sequence and the second feature vector sequence is calculated based on the preset similarity calculation function to obtain the target similarity.

[0013] Furthermore, based on the code vulnerability detection model, the target similarity corresponding to each target translation model is detected and processed, including: Based on the target similarity corresponding to each target translation model, a similarity vector sequence is constructed. Each sub-vector in the similarity vector sequence corresponds to a target similarity. The similarity vector sequence is then fed into the code vulnerability detection model to obtain the vulnerability occurrence probability corresponding to the similarity vector sequence. The code to be translated is characterized as having a vulnerability when the vulnerability occurrence probability is higher than a preset threshold.

[0014] Furthermore, the code vulnerability detection model is an XGBoost binary classification model.

[0015] Secondly, this application also provides a code vulnerability detection system based on a large code translation model, for executing any of the methods in the first aspect, including: The preprocessing module is used to obtain the code to be translated, the initial programming language type and the target programming language type corresponding to the code to be translated, and to preprocess the code to be translated. The forward code translation module is used to translate the code to be translated based on the target translation model and the target programming language, and to obtain forward output code. The code reverse translation module is used to translate the forward output code based on the target translation model and the initial programming language types, and obtain the reverse output code. The similarity calculation module is used to obtain the target similarity between the code to be translated and the reverse output code based on a preset similarity calculation function; The code vulnerability detection module is used to detect the target similarity corresponding to each target translation model through the code vulnerability detection model, and obtain the vulnerability detection results corresponding to the code to be translated.

[0016] Thirdly, this application also provides an electronic device, comprising: at least one memory for storing a program; and at least one processor for executing the program stored in the memory, wherein when the program stored in the memory is executed, the processor is configured to execute any of the methods of the first aspect.

[0017] In summary, the technical solutions conceived by this invention have the following beneficial effects compared with the prior art: This application, based on the initial and target programming language types, 1. employs multiple large-scale translation models to perform forward and reverse translation of the code to be translated. Based on the target similarity between each code to be translated and its corresponding reverse output code, a similarity vector sequence is constructed. This similarity vector sequence can then be used to obtain the probability of vulnerability occurrence through a code vulnerability detection model, thereby accurately determining whether various types of code to be translated contain vulnerabilities. 2. By establishing knowledge bases directly related to the code to be translated, such as a target programming language syntax library, a code vector library, and an extended code library, the large-scale translation models are assisted in translating the code. This improves the translation accuracy of the target large-scale translation model without requiring retraining. The method of this application has the advantages of detecting multiple programming language types, high detection efficiency, and high detection accuracy. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the code vulnerability detection method provided in the embodiments of this application.

[0020] Figure 2 This is a schematic diagram of the structure of the code vulnerability detection system provided in the embodiments of this application.

[0021] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0022] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0023] In the following description, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The following description provides multiple embodiments of this application, which can be substituted or combined with each other. Therefore, this application can also be considered to include all possible combinations of the same and / or different embodiments described. Thus, if one embodiment includes features A, B, and C, and another embodiment includes features B and D, then this application should also be considered to include embodiments containing one or more other possible combinations of A, B, C, and D, even if such embodiments are not explicitly described in the following text.

[0024] The following description provides examples and does not limit the scope, applicability, or examples set forth in the claims. Changes may be made to the function and arrangement of the described elements without departing from the scope of this application. Various processes or components may be appropriately omitted, substituted, or added to the examples. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Furthermore, features described with respect to some examples may be combined into other examples.

[0025] Figure 1 This is a flowchart illustrating the code vulnerability detection method provided in the embodiments of this application, such as... Figure 1 As shown, the method includes at least the following steps: S1. Obtain the code to be translated and the corresponding initial and target programming languages, and preprocess the code to be translated.

[0026] In one possible implementation, the code to be translated is preprocessed, including: Based on the preset regular expressions corresponding to the target programming language, comments in the code to be translated are deleted, and variable names and function names in the code to be translated are standardized based on the keyword table corresponding to the target programming language.

[0027] In this embodiment, when the target translation model traverses the code, it should output the pre-defined keywords of the programming language as is, but when it encounters user-defined variable identifiers and function names, it should rename them to the standard format of "VAR + serial number" and "FUNC + serial number" respectively. The purpose of the preprocessing step is: 1. Deleting comments can eliminate useless text in the code data, ensuring that the model focuses on the logical structure of the code itself and that the content input to the model is a valid code fragment. 2. Unifying variable names and function names can effectively eliminate differences caused by developers' personal coding styles, making similar logic code more consistent in form, thereby improving the accuracy of subsequent similarity comparisons and avoiding similarity differences caused by different naming habits.

[0028] S2. The preprocessed code to be translated is transmitted to each target translation model, and the code to be translated is translated based on the target translation model and the target programming language to obtain the positive output code.

[0029] In this embodiment, the translation of the code to be translated is handled by multiple target translation models. These models include those with strong code translation capabilities such as Claude Sonnet, Grok, and Qwen3-coder. Selecting multiple translation models for forward and reverse translation is to accurately obtain the final vulnerability detection result by utilizing the corresponding similarity of each translation model. Compared with a single large model, this can improve the robustness of the method in this embodiment.

[0030] In one possible implementation, the preprocessed code to be translated is transmitted to each target translation big model, including: Based on the official syntax data, third-party syntax data, and language framework data corresponding to the target programming language and the initial programming language in the database, a target programming language syntax library is constructed. The code to be translated is split into multiple retrieval units based on a preset parser, and features are extracted from each retrieval unit based on the target bidirectional encoder model to obtain multiple vectors to be translated. These vectors are then integrated into a vector library of code to be translated.

[0031] In this embodiment, the database collects publicly available data on various programming languages, including official syntax data, third-party syntax data, and language framework data. The language framework data includes mainstream frameworks such as Pandas and NumPy for Python, React and Express for JavaScript, and Spring for Java. Injecting the target programming language syntax library as external knowledge into the large model ensures that the translated code conforms to the target language's syntax and usage conventions, effectively preventing syntax errors and improving translation accuracy. It also reduces errors in the model's data generation process. The code to be translated mainly consists of translation case data for various programming languages ​​stored in the database. This translation case data includes various example codes and their corresponding translation results in different programming languages.

[0032] In this embodiment, since the code lengths of the example code within the translation case data vary, it needs to be converted into multiple sets of code vectors corresponding to the large-scale translation model. Therefore, a pre-defined parser tool, such as Tree-sitter, is first used to divide the dataset into finer-grained retrieval units. Each retrieval unit extracts a class and a function, and each class or function is considered an item. These items are then embedded into translation vectors using bidirectional encoder models such as CodeBERT or CodeT5. These translation vectors form the training code vector library. The training code vector library can serve as a knowledge base, assisting the subsequent large-scale translation model in more accurately acquiring detailed features of the code to be translated, such as functions and classes. The target programming language syntax library can directly assist the target translation model by providing grammatical knowledge of the target programming language type and the initial programming language type, thereby improving translation efficiency and accuracy.

[0033] In addition, the preprocessed code to be translated is transmitted to each target translation model, including: Based on the target translation big model and each vector to be translated, the code to be translated is extended to obtain an extended code library including multiple extended codes. The code to be translated, the vector library of the code to be translated, the target programming language syntax library and the extended code library are then transmitted to each target translation big model.

[0034] The target translation big data model can parse the items corresponding to each vector of the code to be translated and generate multiple sets of extended code. For example, firstly, the translation big data model generates ten different candidate inputs for each item, then uses the original items for calibration to filter out the valid inputs, and obtains their corresponding outputs by execution. This results in multiple sets of input-output pairs. These input-output pairs are then converted into a format suitable for the target programming language using heuristic rules, thus obtaining multiple sets of extended code.

[0035] S3. Based on the target translation model and the initial programming language types, perform code translation processing on the forward output code to obtain the reverse output code.

[0036] S4. Based on the preset similarity calculation function, obtain the target similarity between the code to be translated and the reverse output code. Based on the code vulnerability detection model, perform detection processing on the target similarity corresponding to each target translation big model to obtain the vulnerability detection result corresponding to the code to be translated.

[0037] In one possible implementation, the target similarity between the code to be translated and the reverse-output code is obtained based on a preset similarity calculation function, including: Based on the target bidirectional encoder model, feature extraction is performed on the code to be translated and the reverse output code respectively to obtain the first feature vector sequence corresponding to the code to be translated and the second feature vector sequence corresponding to the reverse output code. Then, the similarity between the first feature vector sequence and the second feature vector sequence is calculated based on the preset similarity calculation function to obtain the target similarity.

[0038] In this embodiment, the target bidirectional encoder model is the CodeBERT model, and the preset similarity calculation function is:

[0039] in, SMY Indicates the similarity between the two. dot This represents the dot product operation. nor Modulo operation is represented. V1 and V2 These represent the first and second feature vector sequences, respectively. This similarity value reflects the degree of semantic consistency between the original code and the bidirectionally translated code. If the semantics remain good, the similarity is close to 1; if there are logical discrepancies or potential vulnerabilities, the similarity decreases.

[0040] In one possible implementation, the similarity of targets corresponding to each target translation model is detected based on a code vulnerability detection model, including: Based on the target similarity corresponding to each target translation model, a similarity vector sequence is constructed. Each sub-vector in the similarity vector sequence corresponds to a target similarity. The similarity vector sequence is then fed into the code vulnerability detection model to obtain the vulnerability occurrence probability corresponding to the similarity vector sequence. The code to be translated is characterized as having a vulnerability when the vulnerability occurrence probability is higher than a preset threshold.

[0041] In this embodiment of the application, the code vulnerability detection model is a binary classification XGBoost model. The XGBoost model classifies the similarity vector sequence to obtain the probability of vulnerability occurrence. When the vulnerability probability is greater than the threshold of 0.7, it indicates that the code to be translated corresponding to the similarity vector sequence has a vulnerability. The preset threshold can be set to any value between 0.5 and 1.

[0042] Figure 2 This is a schematic diagram of the structure of a code vulnerability detection system based on a large code translation model provided in an embodiment of this application, as shown below. Figure 2 As shown, the system includes at least: The preprocessing module is used to obtain the code to be translated, the initial programming language type and the target programming language type corresponding to the code to be translated, and to preprocess the code to be translated. The forward code translation module is used to translate the code to be translated based on the target translation model and the target programming language, and to obtain forward output code. The code reverse translation module is used to translate the forward output code based on the target translation model and the initial programming language types, and obtain the reverse output code. The similarity calculation module is used to obtain the target similarity between the code to be translated and the reverse output code based on a preset similarity calculation function; The code vulnerability detection module is used to detect the target similarity corresponding to each target translation model through the code vulnerability detection model, and obtain the vulnerability detection results corresponding to the code to be translated.

[0043] like Figure 3 As shown, Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: a processor 301, a communications interface 302, a memory 303, and a communication bus 304. The processor 301, communications interface 302, and memory 303 communicate with each other via the communication bus 304. The processor 301 can call software instructions stored in the memory 303 to execute the methods described in the above embodiments.

[0044] Furthermore, the logical instructions in the aforementioned memory 303 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application.

[0045] Based on the methods in the above embodiments, this application provides a computer-readable storage medium storing a computer program that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0046] Based on the methods in the above embodiments, this application provides a computer program product that, when run on a processor, causes the processor to execute the methods in the above embodiments.

[0047] It is understood that the processor in the embodiments of this application can be a CPU (Central Processing Unit), or other general-purpose processors, DSPs (Digital Signal Processors), ASICs (Application Specific Integrated Circuits), FPGAs (Field Programmable Gate Arrays), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor can be a microprocessor or any conventional processor.

[0048] The method steps in this application embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, ROM (Read-only Memory), PROM (Programmable ROM), EPROM (Erasable PROM), EEPROM (Electrically Erasable EPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0049] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line DSL) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., SSD (Solid State Disk)).

[0050] It is understood that the various numerical designations used in the embodiments of this application are merely for the convenience of description and are not intended to limit the scope of the embodiments of this application.

[0051] Those skilled in the art will readily understand that the above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A code vulnerability detection method based on a code translation large model, characterized in that, The method comprises the following steps: S1, obtaining the to-be-translated code, the initial programming language category corresponding to the to-be-translated code, and the target programming language category, and preprocessing the to-be-translated code; S2, transmitting the preprocessed to-be-translated code to each target translation large model, and based on the target translation large model and the target programming language category, performing code translation processing on the to-be-translated code to obtain forward output code; S3, based on the target translation large model and the initial programming language category, performing code translation processing on the forward output code to obtain reverse output code; S4, based on a preset similarity calculation function, obtaining the target similarity between the to-be-translated code and the reverse output code, detecting the target similarity corresponding to each target translation large model based on a code vulnerability detection model to obtain a vulnerability detection result corresponding to the to-be-translated code.

2. The code vulnerability detection method according to claim 1, characterized in that, The preprocessing of the to-be-translated code comprises: based on the preset regular expression corresponding to the target programming language category, deleting the comments in the to-be-translated code, and based on the keyword table corresponding to the target programming language category, performing uniformization processing on the variable names and function names in the to-be-translated code.

3. The method of claim 2, wherein The transmission of the preprocessed to-be-translated code to each target translation large model comprises: based on the official syntax data, third-party syntax data and language framework data corresponding to the target programming language category and the initial programming language category in the database, constructing a target programming language syntax library; based on a preset parser, splitting the to-be-translated code into multiple retrieval units, and based on a target bidirectional encoder model, performing feature extraction on each retrieval unit to obtain multiple to-be-translated vectors, and integrating each to-be-translated vector into a to-be-translated code vector library.

4. The code vulnerability detection method according to claim 3, characterized in that, The transmission of the preprocessed to-be-translated code to each target translation large model comprises: based on the target translation large model and each to-be-translated vector, performing code expansion processing on the to-be-translated code to obtain an expansion code library comprising multiple expansion codes, and transmitting the to-be-translated code, the to-be-translated code vector library, the target programming language syntax library and the expansion code library to each target translation large model.

5. The method of claim 4, wherein, The code translation processing of the to-be-translated code based on the target translation large model and the target programming language category comprises: based on the to-be-translated code vector library, the target programming language syntax library and the expansion code library, assisting the translation process of the target translation large model, and based on the target programming language category, performing code translation processing on the to-be-translated code through the assisted target translation large model.

6. The method of claim 5, wherein, The target similarity between the to-be-translated code and the reverse output code based on the preset similarity calculation function comprises: The target bidirectional encoder model is used for feature extraction on the to-be-translated code and the reverse output code respectively, to obtain a first feature vector sequence corresponding to the to-be-translated code and a second feature vector sequence corresponding to the reverse output code, and a target similarity is obtained by calculating the similarity between the first feature vector sequence and the second feature vector sequence based on a preset similarity calculation function.

7. The code vulnerability detection method according to claim 6, wherein The target similarity corresponding to each of the target translation large models is detected by the code vulnerability detection model, including: Based on the target similarity corresponding to each of the target translation large models, a similarity vector sequence is constructed, each sub-vector in the similarity vector sequence corresponds to a target similarity, and the similarity vector sequence is fed to the code vulnerability detection model to obtain a vulnerability occurrence probability corresponding to the similarity vector sequence, and the to-be-translated code is represented as having a vulnerability when the vulnerability occurrence probability is higher than a preset threshold.

8. The method of claim 7, wherein, The code vulnerability detection model is an XGBoost binary classification model.

9. A code vulnerability detection system based on a large code translation model, configured to implement the method of any one of claims 1-8. Including: A preprocessing module is configured to obtain to-be-translated code, an initial programming language category corresponding to the to-be-translated code, and a target programming language category, and to pre-process the to-be-translated code; A code forward translation module is configured to perform code translation processing on the to-be-translated code based on the target translation large model and the target programming language category, to obtain forward output code; A code reverse translation module is configured to perform code translation processing on the forward output code based on the target translation large model and the initial programming language category, to obtain reverse output code; A similarity calculation module is configured to obtain a target similarity between the to-be-translated code and the reverse output code based on a preset similarity calculation function; A code vulnerability detection module is configured to detect the target similarity corresponding to each of the target translation large models by a code vulnerability detection model, to obtain a vulnerability detection result corresponding to the to-be-translated code.

10. An electronic device, comprising: Including: At least one memory for storing a computer program; At least one processor for executing the program stored in the memory, when the program stored in the memory is executed, the processor is configured to execute the method of any one of claims 1-8.

Images